A county SOC wants CloudWatch alarms and EventBridge security events from every workload account to land in one security and operations account so on-call can respond from a single place. Which multi-account notification strategy best meets that need?
Select an answer to reveal the explanation.
Short Explanation
Think of every department fire alarm still ringing in its own closet — useless for a night watch that needs one board. Pipe CloudWatch and EventBridge signals from all accounts into the security/ops account so on-call sees one panel, not fifty logins.
Full Explanation
A county SOC that wants CloudWatch alarms and EventBridge security events from every workload account in one place should fan those notifications into a central security and operations account. Cross-account EventBridge buses or CloudWatch alarm and SNS patterns deliver alerts to a single on-call triage surface so analysts do not switch consoles per department during an incident. That multi-account notification strategy matches how municipal SOCs actually staff after-hours response for parks, courts, and utilities alike.
Leaving each account with isolated local SNS topics forces analysts to hop accounts for every alert and misses cross-account correlation when a phishing wave hits several departments at once. Emailing every developer mailbox directly from each member account without a security account bus creates noise without a single operations owner accountable for acknowledgment. Publishing only to public internet webhooks with no cross-account EventBridge or CloudWatch design weakens authenticity, authorization, and central governance of the notification path.
Exam caveat: EventBridge cross-account event buses are the modern fan-in pattern; pair them with a security tooling account rather than per-account inbox chaos. Operational check: configure member rules to put events on the security account bus, fire a test CloudWatch alarm and a security finding event, confirm on-call paging from the central account only, and deny unauthenticated public webhook-only designs in architecture review.